MD5: ea8206f0d49edd479a34c038148467c8
SHA1: ae266cf30f4b570c282161268ffdb8003f66555c
SHA256: 1ffdfdfc49c4a52b22694258509ae50e5cabedefc86e272715d782293c2f35b2
SSDeep: 6144:fTGCfj8CEsu9PMuUpv1gsDXXI1ZkghODq2nBf53YKXEla:ftAKupkfBXXIy9Dq2LX0l
Size: 280576 bytes
File type: PE32
Platform: WIN32
Entropy: Packed
PEID: UPolyXv05_v6
Company: no certificate found
Created at: 2005-11-25 10:41:52

Summary:

Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).

Payload

No specific payload has been found.

Process activity

The Trojan creates the following process(es):

1.tmp:3616
msiexec.exe:1260
ea8206f0d49edd479a34c038148467c8.exe:3896
ea8206f0d49edd479a34c038148467c8.exe:3404

The Trojan injects its code into the following process(es):

ea8206f0d49edd479a34c038148467c8.exe:2636

File activity

The process ea8206f0d49edd479a34c038148467c8.exe:2636 makes changes in a file system.
The Trojan creates and/or writes to the following file(s):

%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
%System%\config\software.LOG (5028 bytes)
%System%\config\software (1696 bytes)
%Program Files%\LP\F2F4\C29.exe (267618 bytes)
%Program Files%\LP\F2F4\1.tmp (12588 bytes)
%Documents and Settings%\%current user%\Application Data\443B0\0B72.43B (3946 bytes)

Registry activity

The process 1.tmp:3616 makes changes in a system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "F3 9D B6 76 A3 49 9E F6 54 3B 54 73 57 1D 2B F5"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKCU\Software\WinRAR]
"HWID" = "7B 32 30 44 43 33 33 37 36 2D 45 32 44 46 2D 34"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

The process msiexec.exe:1260 makes changes in a system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "13 FB 23 00 73 A9 C8 28 3A D5 4C B4 F9 9B 30 C5"

The process ea8206f0d49edd479a34c038148467c8.exe:2636 makes changes in a system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "3F 6C D7 7E D4 D3 07 42 96 51 12 03 0F FD CA 3C"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cookies" = "%Documents and Settings%\%current user%\Cookies"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"History" = "%Documents and Settings%\%current user%\Local Settings\History"

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Common AppData" = "%Documents and Settings%\All Users\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = "1"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyServer" = "http=127.0.0.1:54323"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"SavedLegacySettings" = "46 00 00 00 40 00 00 00 03 00 00 00 14 00 00 00"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections]
"DefaultConnectionSettings" = "46 00 00 00 03 00 00 00 03 00 00 00 14 00 00 00"

To automatically run itself each time Windows is booted, the Trojan adds the following link to its file to the system registry autorun key:

[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"C29.exe" = "%Program Files%\LP\F2F4\C29.exe"

Automatic startup of the following service is disabled:

[HKLM\System\CurrentControlSet\Services\wscsvc]
"Start" = "3"

The Trojan deletes the following value(s) in system registry:

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"AutoConfigURL"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyOverride"

The process ea8206f0d49edd479a34c038148467c8.exe:3896 makes changes in a system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "4E 56 87 AB B2 49 33 3D 2B CF FB A2 12 D0 6B 14"

The process ea8206f0d49edd479a34c038148467c8.exe:3404 makes changes in a system registry.
The Trojan creates and/or sets the following values in system registry:

[HKLM\SOFTWARE\Microsoft\Cryptography\RNG]
"Seed" = "A5 F9 18 19 12 AB C5 1A 42 C6 5D 2D 3F B4 63 0F"

Network activity (URLs)

URL	IP
hxxp://e6845.ce.akamaiedge.net/pca3-g2.crl
hxxp://e6845.ce.akamaiedge.net/CSC3-2009.crl
hxxp://e6845.ce.akamaiedge.net/pca3.crl
hxxp://e6845.ce.akamaiedge.net/CSC3-2009-2.crl
crl.verisign.com	23.61.69.163
csc3-2009-2-crl.verisign.com	23.61.69.163
csc3-2009-crl.verisign.com	23.65.5.163
transaerosystems.com	Unresolvable

Rootkit activity

No anomalies have been detected.

Propagation

Remove it with Ad-Aware

1. Click (here) to download and install Ad-Aware Free Antivirus.
2. Update the definition files.
3. Run a full scan of your computer.

Manual removal*

1. Terminate malicious process(es) (How to End a Process With the Task Manager):
   

   1.tmp:3616
   ea8206f0d49edd479a34c038148467c8.exe:3896
   ea8206f0d49edd479a34c038148467c8.exe:3404

2. Delete the original Trojan file.
   
3. Delete or disinfect the following files created/modified by the Trojan:
   

   %Documents and Settings%\%current user%\Local Settings\Temporary Internet Files\Content.IE5\desktop.ini (67 bytes)
   %System%\config\software.LOG (5028 bytes)
   %Program Files%\LP\F2F4\C29.exe (267618 bytes)
   %Program Files%\LP\F2F4\1.tmp (12588 bytes)
   %Documents and Settings%\%current user%\Application Data\443B0\0B72.43B (3946 bytes)

4. Delete the following value(s) in the autorun key (How to Work with System Registry):
   

   [HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
   "C29.exe" = "%Program Files%\LP\F2F4\C29.exe"

5. Clean the Temporary Internet Files folder, which may contain infected files (How to clean Temporary Internet Files folder).
   
6. Reboot the computer.
   

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.